How to meet it
OWASP AISVS v1.01
Input Validation · Prompt Injection Defenses
Screen inputs for prompt injection
Verify that all inputs that could steer model behavior are treated as untrusted and screened by a prompt injection detection ruleset or classifier, with flagged inputs blocked.
OWASP AISVS v1.01, requirement 2.1.3
In plain English
Anything that ends up in the prompt can carry instructions: the user's message, but also uploaded files, documents found by search, web pages and tool results. Run all of it past a detector before it reaches the model, and block what gets flagged.
What good looks like
- Every route into the prompt is listed: the chat box, uploads, retrieved documents, web pages, emails, tool and MCP responses.
- A detector checks each of those routes before the prompt is put together.
- Flagged input is blocked, the person sees a neutral message, and the event is logged.
- Thresholds are set on purpose and reviewed against real false-positive data.
How teams usually do it
- Managed guardrails from your model platform, for example Azure AI Content Safety Prompt Shields or the prompt attack filter in Amazon Bedrock Guardrails.
- An open classifier model run in your own stack, for example Meta's Prompt Guard, or a dedicated vendor API.
- Simple rules for known attack phrases as a cheap first layer in front of a classifier, never instead of one.
Evidence an auditor would accept
- A data-flow diagram showing every input route and where screening happens.
- The detector configuration and thresholds.
- Results from a prompt injection test set, with the block rate and false-positive rate.
- Sample log entries for blocked inputs.
Common mistakes
- Screening the user's message but not retrieved documents or tool output. For search-based assistants and agents, injection hidden in content is the bigger risk.
- Treating detection as the whole defence. Detectors miss things, so pair this with 2.1.6 and keep tool permissions tight.
- Flagging suspicious input but letting it through anyway.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.